Detailed explanation of Centos configuration file/etc/ssh/ssh_config

Generally, you do not need to modify the OpenSSH client configuration file. For a given user, there are two configuration files :~ /. Ssh/config (user-specific) and/etc/ssh/ssh_config (Global Sharing ). To read these files in this order, for a given parameter, it uses the first configuration found during the read process. You can overwrite the global parameter settings in the following way: set the same parameter in your user configuration file. The parameter priority given on the ssh or scp command line is higher than that set in the two files.

User's ~ The/. ssh/config file must be owned by this user (it is a directory "~ /", And no one except the owner can write the file. Otherwise, the client will provide an error message and exit. This file mode is usually set to 600 because no one except its owner can read it.

The configuration lines in these configuration files contain declarations that start with a keyword (case-insensitive), followed by spaces, and finally parameters (case-sensitive ). You can use the keyword Host to allow the Declaration to only act on a specific system. The Host declaration acts on all the configuration lines between it and the next Host declaration.

CheckHostIP yes | no

If you set it to yes (default ),

In addition to the host name in the file, IP addresses can also be used to identify remote systems.

If it is set to no, only the host name is used. Set CheckHostIP to yes

This improves system security.

ForwardX11 yes | no

If yes, a secure channel is automatically used in untrusted mode.

To forward the X11 connection, but does not set the shell variable DISPLAY.

If ForwardX11Trusted is set to yes, the connection is forwarded in trusted mode.

In addition, you can use option-X on the command line to redirect the X11 connection in untrusted mode.

The default value of this parameter is no. To enable X11 forwarding, you must also

In the/etc/sshd_config file on, set X11Forwarding to yes (see section 8.4.6 ).

For more information, see section 8.6 "X11 forwarding.

ForwardX11Trusted yes | no

When used with ForwardX11, ForwardX11 must be set to yes (default ),

This statement takes effect. When this declaration is set to yes (default ),

When ForwardX11 is set to yes, this Declaration sets the shell variable DISPLAY,

The remote X11 client is granted full access permissions to the original (server) X11 display.

In addition, you can use option-Y on the command line to redirect the X11 connection in trusted mode.

The default value of this statement is no. To enable X11 forwarding, you must also

Set X11Forwarding in the/etc/sshd_config file to yes (see section 8.4.6 ).

For more information, see section 8.6 "X11 forwarding.

HashKnownHosts

When set to yes, OpenSSH will ~ In/. ssh/known_hosts

Host name and address are hashed. When set to no, the host name and address are

. Ubuntu Linux sets this statement to yes to improve the system

Security. For more information about the known_hosts file, see section 2nd of section 8.3.3.

HostHostnames

Specify the declaration after it (until the next host Declaration) only applies

HostnamesMatched host.HostnamesCan contain? And * wildcard.

A single * specifies all hosts. Without this keyword, any declaration applies to all hosts.

HostbasedAuthentication yes | no

When set to yes, try rhosts authentication. High Security Requirements

High system, set to no (default ).

HostKeyAlgorithmsAlgorithms

WhereAlgorithmsIs a list of algorithms separated by commas.

These algorithms are used in sequence. Select from ssh-rsa or ssh-dssAlgorithms

(The default value is "ssh-rsa, ssh-dss ").

PortNum

Use OpenSSHNumPort and remote system connection. The default value is 22.

StrictHostKeyChecking yes | no | ask

Determines whether OpenSSH adds the host key to the user's known_hosts file.

And how to add. If you set this option to ask, connect to the new system

The system will ask whether to add the host key. If it is set to no, it will automatically add

Host key; if set to yes, manually add the host key. If

If the parameter is set to yes or ask, when the host key of a system changes,

OpenSSH rejects connection to the system. For systems with high security requirements,

Set this parameter to yes or ask. The default value is ask.

TCPKeepAlive yes | no

If yes is set, the connection is checked regularly.

If the server crashes or the connection is killed due to other reasons

Check will cause ssh or scp connection interruption, even if the connection is temporarily dead.

If this parameter is set to no, the client will not check whether the connection is alive.

This statement uses the TCP keepalive option, which is unencrypted and vulnerable

IP spoofing (see the glossary ). If you want to use a substitute that can prevent IP spoofing,

You can use server-based technologies. For more information, see "ClientAliveInterval" in section 8.4.6 ".

UserName

Specify the username used to log on to the system. The Host declaration can be used to specify the system.

This option means that when logging on to the remote system, if the user name is different

The user name used to log on to the local system, so you do not have to enter the user name on the command line.